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CONFIRMATION NO. 
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ISSUE FEE 
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$640 
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1 1/04/2002 



THE APPLICATION IDENTIFIED ABOVE HAS BEEN EXAMINED AND IS ALLOWED FOR ISSUANCE AS A PATENT. 
PROgECUTIQN QN THE MERITg IS CLOSED. THIS NOTICE OF ALLOWANCE IS NOT A GRANT OF PATENT RIGHTS. 
THIS APPLICATION IS SUBJECT TO WITHDRAWAL FROM ISSUE AT THE INITIATIVE OF THE OFFICE OR UPON 
PETITION BY THE APPLICANT. SEE 37 CFR L313 AND MPEP 1308. 

THE ISSUE FEE AND PUBLICATION FEE (IF REQUIRED) MUST BE PAID WITHIN THREE MONTHS FROM THE 
MAILING DATE OF THIS NOTICE OR THIS APPLICATION SHALL BE REGARDED AS ABANDONED. THIS STATUTORY 
PERIOD CANNOT BE EXTENDED . SEE 35 U.S.C. 151. THE ISSUE FEE DUE INDICATED ABOVE REFLECTS A CREDIT 
FOR ANY PREVIOUSLY PAID ISSUE FEE APPLIED IN THIS APPLICATION. THE PTOL-85B (OR AN EQUIVALENT) 
MUST BE RETURNED WITHIN THIS PERIOD EVEN IF NO FEE IS DUE OR THE APPLICATION WILL BE REGARDED AS 
ABANDONED. 



HOW TO REPLY TO THIS NOTICE: 

L Review the SMALL ENTITY status shown above. If the SMALL 
ENTITY is shown as YES, verify your current SMALL ENTITY 
Status: 

A. If the status is changed, pay the PUBLICATION FEE (if required) 
and twice the amount of the ISSUE FEE shown above and notify the 
United States Patent and Trademark Office of the change in status, or 

B. If the status is the same, pay the TOTAL FEE(S) DUE shown 
above. 



If the SMALL ENTITY is shown as NO: 



A. Pay TOTAL FEE(S) DUE shown above, or 



B. If applicant claimed SMALL ENTITY status before, or is now 
claiming SMALL ENTITY status, check the box below and enclose 
the PUBLICATION FEE and 1/2 the ISSUE FEE shown above. 

□ Applicant claims SMALL ENTITY status. 
See 37 CFR 1.27. 



IL PART B - FEE(S) TRANSMITTAL should be completed and returned to the United States Patent and Trademark Office (USPTO) with 
your ISSUE FEE and PUBLICATION FEE (if required). Even if the fee(s) have already been paid. Part B - Fee(s) Transmittal should be 
completed and returned. If you are charging the fee(s) to your deposit account, section "4b" of Part B - Fee(s) Transmittal should be 
completed and an extra copy of the form should be submitted. 

III. All communications regarding this application must give the application number. Please direct all communications prior to issuance to 
Box ISSUE FEE unless advised to the contrary. 

IMPORTANT REMINDER: Utility patents issuing on applications filed on or after Dec. 12, 1980 may require payment of 
maintenance fees. It is patentee's responsibility to ensure timely payment of maintenance fees when due. 
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PART B - FEE(S) TRANSMITTAL 



i 



Complete and send this form, together with applicable fee(s), to: Mail 



Fax 



Box ISSUE FEE 
Commissioner for Patents 
Washington, D.C. 20231 
(703)746-4000 



[NSTRUCTIONS: This form should be used for transmitting the ISSUE FEE and PUBLICATION FEE (if required). Blocks 1 through 4 should be completed where 
appropriate. All further correspondence including the Patent, advance orders and notification of maintenance fees will be mailed to the current correspondence address as 
indicated unless corrected below or directed otherwise in Block 1 , by (a) specifying a new correspondence address; and/or (b) indicating a separate 'TEE ADDRESS" for 
maintenance fee notifications. 



CUKKtN I CURKbiPUJNUbJMUb AUURtbii (Note: Legibly mark-i^ with any corrections or use block 1) 
7590 08/02/2002 

DAVID L. FEIGENBAUM 
Fish & Richardson P.O. 
225 Franklin Street 
Boston, MA 02110-2804 



Note: A certificate of mailing can only be used for domestic mailings of the 
Fee(s) Transmittal. This certificate cannot be used for any other 
accompanying papers. Each additional paper, such as an assignment or 
formal drawing, must have its own certificate of mailing or transmission. 

Certificate of Mailing or Transmission 

I hereby certify that this Fee(s) Transmittal is being deposited with the 
United States Postal Service with sufficient postage for first class mail in an 
envelope addressed to the Box Issue Fee address above, or being facsimile 
transmitted to the USPTO, on the date indicated below. 



(Depositor's name) 



(Signature) 



(Dale) 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. 



CONFIRMATION NO. 



09/658, 137 09/08/2000 Phillip Andrew Porras 

TITLE OF INVENTION: HIERARCHICAL EVENT MONITORING AND ANALYSIS 



10454-002002 



3546 



APPLN. TYPE 



SMALL ENTITY 



ISSUE FEE 



PUBLICATION FEE 



TOTAL FEE(S) DUE 



DATE DUE 



nonprc visional 



YES 



$640 



$0 



$640 



11/04/2002 



EXAMINER 



ART UNIT 



CLASS-SUBCLASS 



HECKLER, THOMAS M 



2185 



713-201000 



1 . Change of correspondence address or indication of "Fee Address" (37 
CFR 1.163). 

□ Change of correspondence address (or Change of Correspondence 
Address form PTO/SB/122) attached. 

□ "Fee Address" indication (or "Fee Address" Indication form 
PTO/SB/47; Rev 03-02 or more recent) attached. Use of a Customer 
Number is required. 



2. For printing on the patent front page, hst (I) 
the names of up to 3 registered patent attorneys 
or agents OR, alternatively, (2) the name of a 
single firm (having as a member a registered 
attorney or agent) and the names of up to 2 
registered patent attorneys or agents. If no name 
is listed, no name will be printed. 



3. ASSIGNEE NAME AND RESIDENCE DATA TO BE PRINTED ON THE PATENT (print or type) 

PLEASE NOTE: Unless an assignee is identified below, no assignee data will appear on the patent. Inclusion of assignee data is only appropriate when an assignment has 
been previously submitted to the USPTO or is being submitted under separate cover. Completion of this form is NOT a substitute for filing an assignment. 
(A) NAME OF ASSIGNEE (B) RESIDENCE: (CITY and STATE OR COUNTRY) 



Please check the appropriate assignee category or categories (will not be printed on the patent) □ individual □ corporation or other private group entity □ government 
4a. The following fee(s) ans enclosed: 4b. Pa>Tiient of Fee(s): 

□ Issue Fee ^ ^ check in the amount of the fee(s) is enclosed. 

□ Publication Fee ^ Payment by credit card. Form PTO-2038 is attached. 

□ Advance Order - # of Copies ^ Commissioner is hereby authorized by charge the required fee(s), or credit any overpayment, to 
Deposit Account Number (enclos e an extra copy of this form). 

Commissioner for Patents is requested to apply the Issue Fee and Publication Fee (if any) or to re-apply any previously paid issue fee to the application identified above. 



(Authorized Signature) (Date) 



NOTE; The Issue Fee and Publication Fee (if required) will not be accepted from anyone 
other than the applicant; a registered attorney or agent; or the assignee or other party in 
interest as shown by the records of the United States Patent and Trademark Office. 

This collection of information is required b^ 37 CFR 1.311. The information is required to 
obtain or retain a benefit by the public which is to file (and by the USPTO to process) an 
application. Confidentiality is governed by 35 U.S.C. 122 and 37 CFR 1.14. This collection is 
estimated to take 12 minutes to complete, including gathering, preparing, and submitting the 
completed application form to the USPTO. Time will vary depending upon the individual 
case. Any comments on the amount of time you require to complete this form and/or 
suggestions for reducing this burden, should be sent to the Chief Information Officer, U.S. 
Patent and Trademark Office, U.S. Department of Commerce, Washington, D.C. 20231. DO 
NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS. SEND TO: 
Commissioner for Patents, Washington, DC 2023 1 . 

Under the Paperwork Reduction Act of 1995, no persons are required to respond to a 
collection of information unless it displays a valid OMB control number. 



TRANSMIT THIS FORM WITH FEE(S) 
PTOL-85 (REV. 04-02) Approved for use through 01/3 1/2004. OMB 065 1 -0033 U.S. Patent and Trademaric Office; U.S. DEPARTMENT OF COMMERCE 
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Determination of Patent Term Adjustment under 35 U.S.C. 154 (b) 
(application filed on or after May 29, 2000) 



The patent term adjustment to date is 168 days. If the issue fee is paid on the date that is three months after the 
mailing date of this notice and the patent issues on the Tuesday before the date that is 28 weeks (six and a half 
months) after the mailing date of this notice, the term adjustment will be 168 days. 

If a continued prosecution application (CPA) was filed in the above-identified appUcation, the fiUng date that 
determines patent term adjustment is the filing date of the most recent CPA. 

Applicant will be able to obtain more detailed information by accessing the Patent Application Information Retrieval 
(PAIR) system, (http://pair.uspto.gov) 
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Notice of Fee Increase on October 1, 2002 

If a reply to a "Notice of Allowance and Fee(s) Due" is filed in the Office on or after October 1, 2002, then the 
amount due may be higher than that set forth in the "Notice of Allowance and Fee(s) Due" since there will be an increase 
in fees effective on October 1, 2002. See Revision of Patent and Trademark Fees for Fiscal Year 2003: Notice of 
Proposed Rulemaking . 67 Fed. Reg. 30634, 30636 (May 7, 2002). Although a change to the amount of the publication fee 
is not currently proposed for October 2002, if the issue fee or publication fee is to be paid on or after October 1, 2002, 
applicant should check the USPTO web site for the cxurent fees before submitting the payment. The USPTO Internet 
address for the fee schedule is: http://www.uspto.gov/main/howtofees.htm. 

If the issue fee paid is the amoimt shown on the "Notice of Allowance and Fee(s) Due," but not the correct amount 
in view of the fee increase, a "Notice to Pay Balance of Issue Fee" will be mailed to applicant. In order to avoid 
processing delays associated with mailing of a "Notice to Pay Balance of Issue Fee," if the response to the Notice of 
Allowance and Fee(s) due form is to be filed on or after October 1, 2002 (or mailed with a certificate of mailing on or 
after October 1, 2002), the issue fee paid should be the fee that is required at the time the fee is paid. If the issue fee was 
previously paid, and the response to the "Notice of Allowance and Fee(s) Due" includes a request to apply a 
previously-paid issue fee to the issue fee now due, then the difference between the issue fee amount at the time the 
response is filed and the previously paid issue fee should be paid. S££ Manual of Patent Examining Procedure, Section 
1308.01 (Eighth Edition,^ August 2001). 

Effective October 1, 2002, 37 CFR 1.18 is proposed to be revised to change the patent issue fees as set forth below. As 
stated above, the final fees may be a different amoimt, and applicant should check the web site given above when paying 
the fee. 

(a) Issue fee for issuing each original or reissue patent, except a design or plant patent: 

By a small entiiy (Sec. i.27(a))--$655.00 
By other than a small entity--$ 1,3 10.00 

(b) Issue fee for issuing a design patent: 

By a small entity (Sec. 1.27(a))--$235.00 
By other than a small entity--$470.00 

(c) Issue fee for issuing a plant patent: 

By a small entity (Sec. 1.27(a))--$3 15.00 
By other than a small entity"$630.00 

Questions relating to issue and publication fee payments should be directed to the Customer Service Center 
of the Office of Patent Publication at (703) 305-8283. 
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Application No. 


Applicant(s) 




Notice of Allowability 


09/658.137 


PORRAS ET AL 




Examiner 

Thomas Heckler 


Art Unit 

2185 





- The MAILING DA TE of this communication appears on the cover sheet with the correspondence address-- 

All daims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . 13 This communication is responsive to pre-amendment of 10/10/2000 . 
2. 13 The allowed ciaim(s) is/are 69-90 . 

3. CD The drawings filed on are accepted by the Examiner. 

4. Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a) □ All b) □ Some* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 



3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 
International Bureau (POT Rule 17.2(a)). 
* Certified copies not received: . 

5. □ Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 119(e) (to a provisional application). 

(a) □ The translation of the foreign language provisional application has been received. 

6. □ Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements noted 
below. Failure to timely comply will result in ABANDONMENT of this application. THIS THREE-MONTH PERIOD IS NOT EXTENDABLE 

7. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 
INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

8. 13 CORRECTED DRAWINGS must be submitted. 

(a) 13 including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) 13 hereto or 2) □ to Paper No. . 

(b) □ including changes required by the proposed drawing correction filed , which has been approved by the Examiner. 

(c) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of Paper No. . 



Identifying Indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the top margin (not the back) 

of ssch sheet. The drawings should bs filed as a separate paper with a transmittal letter addressed to the Offlcls! Draftsperscn. 

9. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL nnust be submitted. Note the 
attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1S Notice of References Cited (PTO-892) 
3^ Notice of Draftperson's Patent Drawing Review (PTO-948) 
5S Information Disclosure Statements (PTO-1449), Paper No. 4. 
?□ Examiner's Comment Regarding Requirement for Deposit 
of Biological Material 



20 Notice of Informal Patent Application (PTO-152) 

40 Interview Summary (PTO-413), Paper No. . 

6^ Examiner's Amendment/Comment 

Examiner's Statement of Reasons/or Allowance 

9n other '^^^ii^^i^ /^A^M^ 

Thomas Heckler 
Primary Examiner 
Art Unit: 2185 



U.S. Patent and Trademark Office 

PTO-37 (Rev. 04-01) 



Notice of Allowability 



Part of Paper No. 8 



Application/Control Number: 09/658,137 Page 2 

Art Unit: 2185 



1. An examinees amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. 
To ensure consideration of such an amendment, it MUST be submitted no later than the payment 
of the issue fee. 



2. The application has been amended as follows: 
IN THE SPECIFICATION: 
Page 1, before line 1, insert 



ci 



— Cross Reference To Related Application 
This application is a continuation of U.S. AppHcation No. 09/188,739 filed November 
9, 1998, now U.S. Patent No. 6,321,338.-; 



Page 1, line 6, chan^ "An appendix" to -A microfiche appendix- 



line 6, delete 'xonsisting of 935 pages", 
line 7, before "appendix" insef^picrofiche--, 
line 9, before "appendix" ins^ —microfiche—. 



line 11, after "rights." insert -[ This application contains Microfiche Appendix containing 
ten (10) slides and 956 frames.— 



3. The following is an examiner's statement of reasons for allowance: the prior art does not 
teach a method or apparatus for network monitoring comprising a plurality of network monitors 
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detecting suspicious network activity based on analysis of network traffic data, the monitors 
generating reports of said suspicious activity, and one or more hierarchical monitors to receive 
and integrate the reports of suspicious activity. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 

4. Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Tom Heckler whose telephone number is (703) 305-9666. 

Any inquiry of a general nature or relating to the status of this application should be 
directed to the Technology Center receptionist whose telephone number is (703) 305-3900. 




TH 

July 3 1,2002 



THOMAS M. HECKLER 
PRIMARY EXAMINER 



